#288 gm convert svg: Non-conforming drawing primitive definition (image).

[LiuCougar]

I am using GraphicsMagick shipped with RHEL 7 (the version output is at the bottom)

save the following text as a svg file:

<?xml version="1.0" encoding="utf-8"?><svg height="1682.342007" width="1724.000000" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="scale(3.204,3.204)"><image height="525" width="538" x="0" xlink:href="/tmp/t.png" y="0" /></g></svg>

the above references a png file, please point at a local valid png file (any would do)

then try to convert the svg to a png file using "gm convert", and I got:

gm convert: Non-conforming drawing primitive definition (image).

and gm exit with code 1

GraphicsMagick 1.3.20 2014-08-16 Q16 http://www.GraphicsMagick.org/
Copyright (C) 2002-2014 GraphicsMagick Group.
Additional copyrights and licenses apply to this software.
See http://www.GraphicsMagick.org/www/Copyright.html for details.

Feature Support:
  Native Thread Safe       yes
  Large Files (> 32 bit)   yes
  Large Memory (> 32 bit)  yes
  BZIP                     yes
  DPS                      no
  FlashPix                 no
  FreeType                 yes
  Ghostscript (Library)    no
  JBIG                     yes
  JPEG-2000                yes
  JPEG                     yes
  Little CMS               yes
  Loadable Modules         yes
  OpenMP                   yes (201107)
  PNG                      yes
  TIFF                     yes
  TRIO                     no
  UMEM                     no
  WebP                     yes
  WMF                      yes
  X11                      yes
  XML                      yes
  ZLIB                     yes

Host type: x86_64-redhat-linux-gnu

Configured using the command:
  ./configure  '--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '--program-prefix=' '--disable-dependency-tracking' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--localstatedir=/var' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--enable-shared' '--disable-static' '--docdir=/usr/share/doc/GraphicsMagick-1.3.20' '--with-lcms2' '--with-magick_plus_plus' '--with-modules' '--with-perl' '--with-perl-options=INSTALLDIRS=vendor ' '--with-quantum-depth=16' '--enable-quantum-library-names' '--with-threads' '--with-wmf' '--with-x' '--with-xml' '--without-dps' '--without-gslib' '--with-gs-font-dir=/usr/share/fonts/default/Type1' 'build_alias=x86_64-redhat-linux-gnu' 'host_alias=x86_64-redhat-linux-gnu' 'CFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4

Final Build Parameters:
  CC       = gcc -std=gnu99
  CFLAGS   = -fopenmp -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -Wall -pthread
  CPPFLAGS = -I/usr/include/freetype2 -I/usr/include/libxml2
  CXX      = g++
  CXXFLAGS = -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -pthread
  LDFLAGS  = -Wl,-z,relro -L/usr/lib -L/usr/lib
  LIBS     = -llcms2 -lfreetype -lXext -lSM -lICE -lX11 -llzma -lbz2 -lz -lltdl -lm -lgomp -lpthread

[LiuCougar]

another try at specifying the svg:

    <?xml version="1.0" encoding="utf-8"?>
    <svg height="1682.342007" width="1724.000000" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
    <g transform="scale(3.204,3.204)">
        <image height="525" width="538" x="0" xlink:href="/tmp/t.png" y="0" />
    </g></svg>

[Bob Friesenhahn]

I don't know if xlink is supposed to be working in the implementation but it could be construed as a serious privacy/security issue if any SVG is able to include and render a local file as part of its output. At least this would be a problem if the SVG is uploaded by a remote user for rendering.

Local file URL's normally start like "file://" such that file paths starting from a root path (/path/foo.png) are written like "file:///path/foo.png".

Is SVG rendered by Web browsers allowed to refer to local files?

[Gregory J Wolfe]

The example SVG file (when pointed at a local image) appears to render properly using a current build of GraphicsMagick (Ubuntu and Windows), so the <image> element must have been implemented sometime since this ticket was submitted.

The degree to which this is a security risk is a separate issue.

Thank you for your SVG example.